CVE-2026-62947 – OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

CVE ID :CVE-2026-62947

Published : July 15, 2026, 7:18 p.m. | 15 minutes ago

Description :OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller’s ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

Severity: 4.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…